create-filegrc 0.6.4 → 0.7.0

package/template/data/policies/policy-data-protection-handling.md

@@ -1,130 +0,0 @@
-# Data Protection and Handling Policy
-
-## Purpose
-
-This policy defines how {{company_name}} classifies, accesses, uses, stores, shares, retains, and disposes of data.
-
-## Scope
-
-This policy applies to employees, contractors, vendors, systems, devices, and records that create, receive, process, store, or transmit data on behalf of {{company_name}}.
-
-## Responsibilities
-
-The current Policy Owner owns this policy. System and data owners decide which data a system may process, assign classifications, approve access, and set retention requirements. Everyone in scope must handle data according to its classification and report suspected loss or misuse.
-
-Questions and reports should be sent to {{security_contact_email}}.
-
-## Data classification
-
-Data owners assign the highest classification required by the data in a record, file, system, or transfer.
-
-| Classification | Description | Examples | Minimum handling |
-| --- | --- | --- | --- |
-| Public | Approved for public release | Published web content and public documentation | Protect integrity and use approved publishing processes |
-| Internal | Intended for the workforce and approved partners | Internal procedures and routine business records | Limit access to people with a business need |
-| Confidential | Disclosure could harm {{company_name}}, a customer, or another person | Contracts, financial records, customer data, source code, and security records | Approved systems, access control, encryption in transit and at rest, and protected sharing |
-| Restricted | Disclosure or alteration could cause severe harm or trigger legal duties | Credentials, cryptographic keys, regulated data, and highly sensitive security material | Explicit approval, least privilege, encryption in transit and at rest, and additional monitoring |
-
-When classification is uncertain, treat the data as Confidential until its owner decides.
-
-Credentials, private keys, authentication tokens, and recovery codes must be stored in an approved secrets-management system. Do not put them in source files, tickets, chat messages, policy records, or other general-purpose repositories.
-
-## Data inventory and ownership
-
-{{company_name}} maintains records of systems and important data stores. Those records identify:
-
-- An accountable owner
-- Business purpose
-- Data types and classification
-- Source and authorized recipients
-- Retention or deletion requirements
-- Important vendors and processing locations
-- Security and recovery needs
-
-Owners review their records at least annually and after a material change.
-
-## Collection and use
-
-Collect only data needed for an approved business purpose. Tell people how their personal data will be used when required. Do not reuse data for an incompatible purpose without review and approval.
-
-Access must follow least privilege. Owners approve access based on job duties, and managers or system owners review access at least quarterly for systems containing Restricted data and at least annually for other important systems.
-
-Do not browse, copy, export, or analyze data out of curiosity or for personal use.
-
-## Access approval and removal
-
-Access to Confidential or Restricted data follows this process:
-
-1. A manager or data owner requests access for a stated role and business need.
-2. The reviewer checks that the requested access is the minimum needed.
-3. The system owner or security owner approves elevated or sensitive access.
-4. An authorized administrator provisions the access and records the decision.
-5. Access changes and removals follow the same approval and recording requirements. Departures and role changes are handled promptly under the Information Security Policy.
-
-## Storage
-
-Internal, Confidential, and Restricted data must be stored in services approved for its classification. Local storage should be limited to a business need.
-
-Confidential and Restricted data must be encrypted in transit over untrusted networks and at rest in approved systems and on devices. Encryption keys and data must have separate access controls where practical.
-
-Production data must not be copied into development or test systems unless the owner approves the use and those systems meet the same protection requirements. Prefer generated or de-identified test data.
-
-Paper records containing Confidential or Restricted data must be secured when unattended and destroyed with an approved method.
-
-## Sharing and transfer
-
-Before sharing Confidential or Restricted data, verify:
-
-- The recipient and business need
-- The minimum data required
-- The recipient's authorization
-- The transfer method and destination
-- Contractual, privacy, and geographic restrictions
-
-Use approved encrypted channels. Do not send Restricted data through personal email, consumer file-sharing accounts, or unapproved messaging services.
-
-Public links must not be used for Confidential or Restricted data. Time-limit external access where the system supports it, and remove access when the business need ends.
-
-## Vendors and subprocessors
-
-Vendors that process Confidential or Restricted data must complete a security and privacy review before access begins. Contracts must state the permitted use, protection, incident notification, return or deletion, and any required audit rights.
-
-Owners review critical vendors at least annually and when the service or data use changes materially.
-
-## Retention and disposal
-
-Keep data only as long as required for its business purpose and applicable legal, contractual, tax, audit, or security needs. Data owners document retention rules for important record classes in the Data Retention Schedule.
-
-When retention ends, delete or anonymize the data through an approved process. Approved methods include cryptographic erase or secure wiping for reusable media and physical destruction, pulverization, or shredding for media that will not be reused. Choose a method suited to the medium and data classification.
-
-Disposal must cover active systems, local copies, and vendor-held data where practical. Backup copies may expire through the normal protected backup cycle if they cannot be selectively deleted.
-
-Legal holds and active investigations suspend normal deletion for the affected data.
-
-The policy owner reviews the Data Retention Schedule at least annually and within 30 days after a material change to systems, data use, vendors, contracts, or applicable duties. The schedule's approver must be separate from its owner.
-
-## Personal data requests
-
-Requests to access, correct, export, restrict, or delete personal data must be sent to the responsible privacy or legal owner. Track the request using the minimum personal data needed. This repository should use an opaque case ID and an approved-system reference when keeping the person's identity in Git would conflict with deletion duties.
-
-## Security incidents
-
-Report suspected loss, unauthorized access, unintended disclosure, or improper disposal immediately to {{security_contact_email}}. Do not delete evidence, contact affected people, or make external statements unless the incident lead authorizes it.
-
-{{company_name}} will investigate, contain, document, and notify affected parties as required by its incident process and applicable obligations.
-
-## Training and compliance
-
-Workers receive data-handling training when they join and at least annually. Additional training may be required for people who handle Restricted data.
-
-People who develop or materially change applications complete secure-development training within 30 days of starting those duties or changing into a covered role. Training covers common application risks, access control, input handling, secrets, logging, dependencies, and secure review.
-
-Violations may result in access removal, corrective action, contract remedies, or other action allowed by law and agreement.
-
-Exceptions require a documented business reason, owner, risk assessment, compensating controls, expiration date, and approval from the current Policy Owner.
-
-## Review
-
-{{company_name}} assesses data-protection risks at least annually, either as part of the information security risk assessment or as a separate assessment. The assessment covers material changes in data use, systems, vendors, contracts, and applicable duties.
-
-The policy owner reviews this policy at least annually and after a material change to data use, law, contracts, or systems. Git history records approvals and changes.

package/template/data/policies/policy-employee-handbook.json

@@ -1,21 +0,0 @@
-{
-  "id": "policy-employee-handbook",
-  "type": "policy",
-  "title": "Employee Handbook",
-  "status": "draft",
-  "ownerIds": [
-    "appointment-policy-owner"
-  ],
-  "policyKind": "workforce-conduct",
-  "version": "1.0",
-  "audience": [
-    "employees"
-  ],
-  "acknowledgementRequired": true,
-  "relatedDocumentIds": [
-    "document-employee-handbook-acknowledgement",
-    "document-employee-policy-acknowledgement"
-  ],
-  "proposedEffectiveOn": "{{effective_date}}",
-  "programRole": "conditional"
-}

package/template/data/policies/policy-employee-handbook.md

@@ -1,161 +0,0 @@
-# Employee Handbook
-
-## Purpose and status
-
-This optional handbook template sets a common baseline for employment practices, workplace conduct, information security, and use of {{company_name}} resources. An employee handbook is not required for SOC 2.
-
-It is not an employment contract or legal advice. It does not promise employment for a fixed term or change any written employment agreement. Local law, written employment terms, benefit plans, and approved regional supplements control when they differ from this handbook. Do not approve or distribute this template until qualified counsel has reviewed it for each place where {{company_name}} employs people and the company has named its people contact, reporting routes, and required regional supplements.
-
-## Scope and responsibility
-
-This handbook applies to employees. Contractors follow the conduct and security requirements assigned to them under their agreements and applicable policies.
-
-Managers are responsible for applying this handbook fairly, seeking advice when local requirements are unclear, and raising concerns instead of resolving serious matters informally. Employees are responsible for reading the handbook, asking questions, following applicable requirements, and reporting suspected violations.
-
-Questions about employment, conduct, accommodations, pay, leave, or workplace safety should be sent to a manager or the designated people contact through the published company reporting route. Security events should be sent to {{security_contact_email}}.
-
-## Communication and problem solving
-
-Employees should raise routine work questions with their manager. When the issue is not resolved, cannot reasonably be raised with that manager, or affects more than one team, the employee may contact the designated people contact. Employees may also use any reporting route required by law or another company policy.
-
-Managers should listen, gather the relevant facts, explain decisions they are authorized to make, and route matters that require another owner. Employees do not need to follow this informal path before reporting misconduct or exercising a legal right.
-
-## Reporting concerns
-
-Employees should promptly report suspected harassment, discrimination, retaliation, fraud, bribery, unsafe conditions, security events, misuse of data, or other policy violations. A non-security report may be made to a manager, the designated people contact, or another published independent route. Security and data events may also be reported to {{security_contact_email}}. If a person receiving reports is involved in the concern, the employee should use another route. A written report is not required.
-
-{{company_name}} will review reports promptly and impartially, preserve relevant records, limit disclosure to people who need the information, and take appropriate corrective action when warranted. Employees must cooperate honestly. No one may retaliate against a person who makes a good-faith report, requests an accommodation, raises a pay or safety concern, or participates in a review.
-
-## Equal opportunity and accommodations
-
-Employment decisions are based on job-related qualifications, performance, business needs, and lawful requirements. {{company_name}} prohibits unlawful discrimination based on a characteristic protected in the employee's work location.
-
-{{company_name}} provides reasonable accommodations for disability, religion, pregnancy and related conditions, and other protected needs when required by law. Employees may request an accommodation from their manager or the designated people contact without using special words. {{company_name}} and the employee will discuss the work limitation, possible accommodations, and any information lawfully needed to evaluate the request. Retaliation for requesting or using an accommodation is prohibited.
-
-## Harassment and respectful conduct
-
-Harassment, bullying, threats, and other abusive conduct are prohibited. Unlawful harassment includes unwelcome conduct tied to a protected characteristic when the conduct creates a hostile work setting or affects an employment decision.
-
-Prohibited conduct may include slurs, insults, threats, unwanted sexual attention, repeated offensive jokes, degrading images, unwelcome touching, or conditioning a work benefit on personal or sexual conduct. Harassment can occur between people of any role or identity, and a person may report conduct even when it was directed at someone else.
-
-These rules apply in offices, remote work, digital channels, travel, customer interactions, social events connected to work, and any other setting where conduct affects the workplace.
-
-## Ethical conduct and conflicts
-
-Act honestly and in the best interests of {{company_name}} while performing company work. Follow applicable laws, contracts, and company policies.
-
-Disclose an actual or potential conflict of interest to the policy owner before taking part in the related decision. This includes a financial interest, outside role, close personal relationship, gift, or other circumstance that could affect judgment.
-
-Do not offer, request, authorize, or accept a bribe, kickback, or improper payment. Gifts and entertainment must follow the Anti-Bribery and Corruption Policy.
-
-Keep complete and accurate business records. Do not hide, falsify, backdate, or destroy information to mislead another person or avoid a review.
-
-Only an authorized spokesperson may make public statements or respond to press, investor, or government inquiries on behalf of {{company_name}}.
-
-## Confidentiality and intellectual property
-
-Protect nonpublic information received from {{company_name}}, customers, workers, vendors, and partners. Use it only for approved work, share it only with authorized people, and follow the Data Protection and Handling Policy.
-
-Employment terms and applicable law determine ownership of work product and intellectual property. Employees must sign any required confidentiality and invention-assignment agreements.
-
-Confidentiality duties continue after employment ends. Nothing in this handbook prohibits lawful reporting to a regulator, discussion of working conditions, or another activity protected by law.
-
-## Company systems and acceptable use
-
-Use company systems, accounts, funds, devices, and other property for authorized purposes. Limited personal use may be allowed when it does not interfere with work, create material cost or risk, violate policy, or break the law.
-
-Do not use company systems to:
-
-- Break the law or another person's rights.
-- Create or distribute discriminatory, harassing, threatening, obscene, or malicious material.
-- Access systems or data without authorization.
-- Run a personal business or political campaign without approval.
-- Send mass unsolicited messages.
-- Install unapproved software that creates material risk.
-- Disable, evade, or interfere with security, monitoring, access, or retention controls.
-
-{{company_name}} may log, review, preserve, or disclose activity on company-managed systems as allowed by law and for security, operations, support, compliance, and investigation. Employees should not expect personal privacy in company accounts or devices beyond what law and written policy require.
-
-Employees must protect system integrity, use approved storage and communications tools, and return or delete company data and property when instructed.
-
-## Security responsibilities
-
-Every employee must:
-
-- Complete assigned security and policy training within 30 days of starting and at least annually.
-- Use a unique company identity and approved authentication methods.
-- Enable multi-factor authentication when required.
-- Store passwords and secrets only in approved tools.
-- Keep devices supported, encrypted, locked when unattended, and updated.
-- Follow data classification, clear-screen, mobile-computing, and acceptable-use requirements.
-- Use approved systems for company work.
-- Report suspected phishing, data loss, account compromise, policy violations, and other security events immediately to {{security_contact_email}}.
-- Cooperate with access reviews, investigations, recovery exercises, and audit requests.
-
-Do not bypass security controls, share accounts, or access data without a business need.
-
-## Remote work and travel
-
-Remote and traveling employees must maintain a work setting that protects company conversations, screens, paper records, and devices. Use trusted networks or approved secure access methods. Do not leave devices unattended in public or checked baggage.
-
-Employees remain responsible for attendance, communication, security, safety, and work expectations regardless of location. Approval to work remotely does not authorize work from every location because tax, employment, security, and customer duties may apply.
-
-## Employment classification and records
-
-Written employment terms identify whether a role is full-time, part-time, temporary, exempt, non-exempt, or another classification recognized in the employee's location. Classification affects pay, timekeeping, benefits, and leave, so employees should raise questions promptly.
-
-Employees must keep contact, tax, payment, emergency, and work-authorization records current through the approved process. {{company_name}} limits access to personnel records and uses them only for lawful business purposes.
-
-Requests for employment verification or references must be sent to the authorized people contact.
-
-## Work time, attendance, and pay
-
-Employees must follow their assigned schedule, attend required meetings, and notify their manager promptly when they will be late or absent. Repeated absence, lateness, or failure to report an absence may lead to corrective action, subject to protected leave and local law.
-
-Non-exempt employees must record all time worked accurately, including approved remote work and work outside the usual schedule. Managers must not ask an employee to work off the clock, omit time, or create a false record.
-
-Where overtime approval applies, employees must obtain approval before working overtime. {{company_name}} will still record and pay all hours that law requires, even when the employee did not obtain advance approval. A failure to follow the approval process may be addressed separately.
-
-Written employment terms state the pay schedule and available payment methods. Employees should review pay records and promptly report a suspected error.
-
-## Leave, holidays, and benefits
-
-Benefit plans, written leave policies, and regional supplements define eligibility, enrollment, coverage, holidays, paid time off, sick leave, and other benefits. The applicable plan document controls if a summary conflicts with it.
-
-Employees should request planned leave in advance and give prompt notice when illness or an emergency makes advance notice impractical. {{company_name}} may request only the documentation allowed and needed to administer the leave.
-
-{{company_name}} provides legally required leave and workplace support, which may include family or medical leave, disability leave, pregnancy-related leave, military leave, jury or witness duty, voting leave, work-injury leave, lactation accommodations, and other location-specific rights. A regional supplement or written policy defines duration, pay, eligibility, notice, and return-to-work rules.
-
-{{company_name}} maintains workers' compensation insurance or equivalent coverage where required. Employees must promptly report a work-related injury or illness so the company can address safety and required benefits.
-
-## Expenses
-
-{{company_name}} reimburses approved business expenses under its written expense process and applicable law. Employees must obtain required approval, submit accurate records on time, and return refunds or credits. Do not split, disguise, or misclassify an expense to avoid review.
-
-## Health, safety, and workplace security
-
-Follow workplace safety instructions and report hazards, injuries, threats, or violence as soon as practical after becoming aware of them. Call local emergency services when someone faces an immediate threat.
-
-Threats, intimidation, fighting, stalking, and workplace violence are prohibited. Weapons are prohibited where company rules and applicable law allow such a restriction. Employees must not work while impaired by alcohol, illegal drugs, or another substance that makes the work unsafe.
-
-Smoking and vaping are allowed only in approved areas and as permitted by local rules. Employees must follow emergency, visitor, facility-access, and incident-reporting procedures.
-
-## Performance and corrective action
-
-Employees are expected to meet job requirements, follow reasonable instructions, protect company resources, and comply with policy. Managers conduct a documented performance review at least annually.
-
-{{company_name}} may use coaching, access restrictions, warnings, reassignment, leave, or separation to address performance or conduct, subject to law and written agreements. It may choose the response suited to the facts and is not required to use a fixed sequence.
-
-Nothing in this handbook limits lawful employee rights.
-
-## Changes and separation
-
-{{company_name}} may revise this handbook as its work, systems, or legal duties change. The policy owner reviews it at least annually. Git history records approvals and changes.
-
-An employee who resigns should give at least two weeks' notice where practical. {{company_name}} may conduct an exit interview. When employment ends, the employee must return company property, records, devices, credentials, and access methods and must not keep company data.
-
-Access is removed under the Information Security Policy. Continuing duties under confidentiality, intellectual-property, and other written agreements remain in effect.
-
-## Acknowledgement
-
-Employees must acknowledge the handbook and assigned policies when they join and when a material update requires a new acknowledgement. An acknowledgement confirms receipt and understanding. It does not create a contract or change lawful employment rights or written employment terms.

package/template/data/policies/policy-mobile-computing-communications.json

@@ -1,18 +0,0 @@
-{
-  "id": "policy-mobile-computing-communications",
-  "type": "policy",
-  "title": "Mobile Computing and Communications Policy",
-  "status": "draft",
-  "ownerIds": [
-    "appointment-policy-owner"
-  ],
-  "policyKind": "information-security",
-  "version": "1.0",
-  "audience": [
-    "employees",
-    "contractors"
-  ],
-  "acknowledgementRequired": true,
-  "proposedEffectiveOn": "{{effective_date}}",
-  "programRole": "supporting"
-}

package/template/data/policies/policy-mobile-computing-communications.md

@@ -1,74 +0,0 @@
-# Mobile Computing and Communications Policy
-
-## Purpose
-
-{{company_name}} permits mobile and remote work when devices and communications are protected against loss, interception, unauthorized access, and misuse.
-
-## Scope
-
-This policy applies to laptops, phones, tablets, removable media, home networks, messaging tools, and other technology used to access {{company_name}} information or systems.
-
-## Approved devices and services
-
-- Use company-managed devices for confidential or restricted information unless the policy owner approves another arrangement.
-- Use only approved storage, messaging, meeting, email, and file-transfer services.
-- Do not move company data to personal accounts or unapproved applications.
-- Do not disable security agents, management software, logging, encryption, or remote-wipe controls.
-- Rooted, jailbroken, or otherwise security-disabled devices may not access company systems.
-
-## Device security
-
-Devices that access company systems must:
-
-- Use full-device encryption.
-- Require a password, passcode, or approved biometric control.
-- Lock automatically after no more than 15 minutes of inactivity.
-- Use supported operating systems and security updates.
-- Install security updates within the remediation targets in the Information Security Policy unless testing or compatibility requires a documented exception.
-- Run approved malware protection when available for the platform.
-- Permit remote lock or wipe when technically supported.
-
-Passwords and recovery codes must not be stored in unsecured notes, messages, or browser fields.
-
-## Authentication and access
-
-- Use multi-factor authentication for remote access and other systems that support it.
-- Do not share accounts or authentication factors.
-- Connect through approved secure access methods.
-- Access only the information needed for assigned work.
-- Remove local copies of confidential information when the work no longer requires them.
-
-## Networks and communications
-
-- Protect home wireless networks with current encryption and a non-default administrator password.
-- Avoid transmitting confidential information over public networks. When public access is unavoidable, use an approved encrypted connection.
-- Verify recipients before sending confidential information.
-- Use approved encryption for files sent outside controlled company systems.
-- Do not discuss confidential matters where unauthorized people can overhear them.
-
-## Physical protection
-
-- Keep devices under personal control or secured in a locked location.
-- Do not leave devices visible in an unattended vehicle.
-- Use privacy screens where shoulder surfing is likely.
-- Keep authentication devices separate from an unattended computer when practical.
-
-## Personal devices
-
-Use of a personal device requires written approval before company access begins. The device must be registered in the asset inventory, and the owner must verify the required encryption, screen lock, supported software, security updates, malware protection where available, and remote removal conditions before use. The user must permit the security controls needed to protect company information and must separate company data from personal data where the platform supports it.
-
-{{company_name}} may remove company accounts and data from an approved personal device when access ends, a device is lost, or a security event requires it.
-
-The policy owner reviews authorized mobile devices, personal-device approvals, and remote-access methods at least annually. Unused or unsupported connections must be removed.
-
-## Loss, theft, or compromise
-
-Report a lost, stolen, or suspected compromised device immediately to the current Policy Owner at {{security_contact_email}}. Do not delay reporting while attempting to recover or investigate the device.
-
-## Return and disposal
-
-When employment, a contract, or device use ends, return company equipment and remove company data from any approved personal device. Devices and media must be wiped or destroyed using an approved method before reuse or disposal.
-
-## Review
-
-The policy owner reviews this policy at least annually and after a material change in remote-access technology or risk.

package/template/data/training/training-anti-bribery-high-risk-roles.json

@@ -1,16 +0,0 @@
-{
-  "id": "training-anti-bribery-high-risk-roles",
-  "type": "training",
-  "title": "Anti-Bribery Training for Higher-Risk Roles",
-  "status": "draft",
-  "ownerIds": ["appointment-policy-owner"],
-  "audience": ["sales", "finance", "procurement", "government-interaction", "third-party-agents"],
-  "assignmentTrigger": "covered-role-start-or-change",
-  "completionWindowDays": 30,
-  "policyIds": ["policy-anti-bribery-corruption"],
-  "controlIds": [
-    "control-security-governance",
-    "control-workforce-expectations",
-    "control-security-training"
-  ]
-}

package/template/data/training/training-anti-bribery-high-risk-roles.md

@@ -1,19 +0,0 @@
-# Anti-Bribery Training for Higher-Risk Roles
-
-## Who must complete this
-
-Assign this training when a role handles sales, procurement, payments, gifts or hospitality, government interaction, higher-risk locations, or third parties acting for the company. Complete it within 30 days after starting a covered role or taking on covered duties.
-
-## Required practices
-
-- Never offer, request, accept, authorize, or conceal an improper payment or anything of value.
-- Apply the policy to cash, gifts, travel, meals, jobs, discounts, donations, favors, and payments made through another party.
-- Obtain required approval before gifts, hospitality, donations, sponsorships, or engagement of a higher-risk third party.
-- Apply added care to government officials and people acting for a public body.
-- Record transactions accurately. Do not use false descriptions, side accounts, or undisclosed arrangements.
-- Stop and report pressure to bypass review, split payments, use unusual payment routes, or hide the recipient or purpose.
-- Report concerns through an approved independent route. Retaliation for a good-faith report is prohibited.
-
-## Completion
-
-Review the Anti-Bribery and Anti-Corruption Policy with this material. Record an attestation tied to the Git revisions reviewed. If the role does not present the risks above, record that decision instead of a completion.

package/template/data/training/training-privileged-sensitive-roles.json

@@ -1,20 +0,0 @@
-{
-  "id": "training-privileged-sensitive-roles",
-  "type": "training",
-  "title": "Privileged and Sensitive Role Training",
-  "status": "draft",
-  "ownerIds": ["appointment-policy-owner"],
-  "audience": ["privileged-administrators", "security", "finance", "privacy", "people-operations"],
-  "assignmentTrigger": "covered-role-start-or-change",
-  "completionWindowDays": 30,
-  "policyIds": [
-    "policy-data-protection-handling",
-    "policy-information-security"
-  ],
-  "controlIds": [
-    "control-security-training",
-    "control-access-authorization",
-    "control-strong-authentication",
-    "control-incident-response"
-  ]
-}

package/template/data/training/training-privileged-sensitive-roles.md

@@ -1,20 +0,0 @@
-# Privileged and Sensitive Role Training
-
-## Who must complete this
-
-Assign this training to people with administrative access or security, finance, privacy, or people-operations duties. Complete it within 30 days after starting a covered role or taking on covered duties.
-
-## Required practices
-
-- Use separate administrative access where practical and use it only for administrative work.
-- Grant, use, and retain the minimum access needed for the assigned duty.
-- Require the documented approval and second review that applies to sensitive actions.
-- Verify unusual payment, identity, access, data, or account-change requests through an independent channel.
-- Keep Confidential and Restricted records in approved systems and share only the minimum needed.
-- Do not bypass logging, approval, retention, or monitoring controls.
-- Record material decisions and preserve the evidence needed for later review.
-- Escalate suspected fraud, privacy, access, or security events immediately through an approved route.
-
-## Completion
-
-Review the policies that apply to the assigned role with this material. Record an attestation tied to the Git revisions reviewed. If a person's role does not meet the audience above, record that decision instead of a completion.

package/template/data/training/training-secure-development.json

@@ -1,19 +0,0 @@
-{
-  "id": "training-secure-development",
-  "type": "training",
-  "title": "Secure Development Training",
-  "status": "draft",
-  "ownerIds": ["appointment-policy-owner"],
-  "audience": ["engineering", "security", "software-development", "infrastructure"],
-  "assignmentTrigger": "covered-role-start-or-change",
-  "completionWindowDays": 30,
-  "policyIds": [
-    "policy-data-protection-handling",
-    "policy-information-security"
-  ],
-  "controlIds": [
-    "control-security-training",
-    "control-change-management",
-    "control-vulnerability-management"
-  ]
-}

package/template/data/training/training-secure-development.md

@@ -1,22 +0,0 @@
-# Secure Development Training
-
-## Who must complete this
-
-Assign this training to people who develop or materially change applications, infrastructure, deployment systems, or security-sensitive automation. Complete it within 30 days after starting a covered role or taking on covered duties.
-
-## Required practices
-
-- Design access checks at each trust boundary and deny access by default.
-- Validate untrusted input and encode output for its destination.
-- Keep credentials, tokens, and private keys in approved secret stores.
-- Do not put production secrets or unnecessary production data in source, tests, logs, or development systems.
-- Review material code and infrastructure changes before deployment.
-- Test changes in proportion to their security and operational risk.
-- Scan dependencies, source, and built artifacts where the toolchain supports it.
-- Record the change, review, test result, deployment, and rollback method.
-- Log security-relevant events without exposing secrets or unnecessary personal data.
-- Report suspected vulnerabilities and security events immediately.
-
-## Completion
-
-Review the Information Security Policy and Data Protection and Handling Policy with this material. Record an attestation tied to the Git revisions reviewed. If a person's role does not meet the audience above, record that decision instead of a completion.